IS-IS Cheat Sheet
IS-IS Ultimate Cheat Sheet
Configuration • Commands • Multi-Area Design • Troubleshooting • Security
Published by MAG212 CYBER · Technical reference for administrators, CCNP learners and network engineers
⬇ Download the PDF edition01 / What is IS-IS?
Intermediate System to Intermediate System (IS-IS) is an interior gateway link-state routing protocol. Routers exchange link-state PDUs (LSPs), synchronize their link-state databases (LSDBs) and run shortest-path-first (SPF) calculations. Integrated IS-IS carries IPv4 information in TLVs; extensions allow IPv6 as well.
| Quick fact | Explanation |
|---|---|
| Algorithm | Dijkstra SPF |
| Transport | Runs directly over Layer 2 (OSI CLNS), not over IP — unlike OSPF (IP protocol 89) or BGP (TCP port 179) |
| Administrative distance | Cisco IOS default: 115 for IS-IS routes |
| Levels | L1 (inside an area); L2 (between areas); L1/L2 router participates in both |
| Identifiers | NET includes area ID, 6-byte system ID, and selector 00 |
| Metric | Modern networks generally use wide metrics; interface cost can be set manually |
02 / L1, L2, and area architecture
| Role | Learning scope | Typical use |
|---|---|---|
| Level 1 | Intra-area LSDB and routes | Access/area-internal forwarding |
| Level 2 | Inter-area backbone topology | Connecting areas |
| Level 1-2 | Maintains a separate L1 and L2 database | Area border connectivity |
Level 1 routers must use matching area addresses to form an L1 adjacency. Level 2 peers can have different area addresses. A Level 1 router typically depends on an attached L1/L2 router for routes beyond its area.
03 / Original three-area enterprise lab
| Link | Left IP | Right IP |
|---|---|---|
| A1 ↔ A2 (L1) | 10.40.1.1/30 | 10.40.1.2/30 |
| B1 ↔ B2 (L1) | 10.40.2.1/30 | 10.40.2.2/30 |
| C1 ↔ C2 (L1) | 10.40.3.1/30 | 10.40.3.2/30 |
| A1 ↔ B1 (L2) | 10.40.12.1/30 | 10.40.12.2/30 |
| B1 ↔ C1 (L2) | 10.40.23.1/30 | 10.40.23.2/30 |
| A1 ↔ C1 backup (L2) | 10.40.13.1/30 | 10.40.13.2/30 |
04 / NET addressing explained
A Network Entity Title (NET) is an NSAP-style identifier. A typical lab NET is 49.0001.0000.0000.0001.00.
| Component | Example | Meaning |
|---|---|---|
| AFI + area | 49.0001 | Private address allocation and Area 1 |
| System ID | 0000.0000.0001 | Unique six-byte router identifier |
| N-selector | 00 | Required for router’s NET |
Use Area 49.0002 for B1/B2 and Area 49.0003 for C1/C2. Within each area, both routers use the same area ID but unique system IDs.
05 / Working Cisco IOS XE configurations
The following sample is an educational IOS XE lab. Interface names vary by platform; ensure interfaces are up and connected as mapped. The examples use point-to-point IS-IS on routed Ethernet ports and wide metrics.
A1 — Area 1 border
hostname A1 router isis CORE net 49.0001.0000.0000.0001.00 is-type level-1-2 metric-style wide log-adjacency-changes ! interface GigabitEthernet0/0 description L1 to A2 ip address 10.40.1.1 255.255.255.252 ip router isis CORE isis circuit-type level-1 isis network point-to-point ! interface GigabitEthernet0/1 description L2 to B1 ip address 10.40.12.1 255.255.255.252 ip router isis CORE isis circuit-type level-2-only isis network point-to-point ! interface GigabitEthernet0/2 description Backup L2 to C1 ip address 10.40.13.1 255.255.255.252 ip router isis CORE isis circuit-type level-2-only isis network point-to-point isis metric 40 level-2 ! interface Loopback0 ip address 172.20.1.1 255.255.255.255 ip router isis CORE
B1 — Area 2 border
hostname B1 router isis CORE net 49.0002.0000.0000.0002.00 is-type level-1-2 metric-style wide ! interface GigabitEthernet0/0 description L1 to B2 ip address 10.40.2.1 255.255.255.252 ip router isis CORE isis circuit-type level-1 isis network point-to-point ! interface GigabitEthernet0/1 description L2 to A1 ip address 10.40.12.2 255.255.255.252 ip router isis CORE isis circuit-type level-2-only isis network point-to-point ! interface GigabitEthernet0/2 description L2 to C1 ip address 10.40.23.1 255.255.255.252 ip router isis CORE isis circuit-type level-2-only isis network point-to-point ! interface Loopback0 ip address 172.20.2.1 255.255.255.255 ip router isis CORE
C1 — Area 3 border
hostname C1 router isis CORE net 49.0003.0000.0000.0003.00 is-type level-1-2 metric-style wide ! interface GigabitEthernet0/0 description L1 to C2 ip address 10.40.3.1 255.255.255.252 ip router isis CORE isis circuit-type level-1 isis network point-to-point ! interface GigabitEthernet0/1 description L2 to B1 ip address 10.40.23.2 255.255.255.252 ip router isis CORE isis circuit-type level-2-only isis network point-to-point ! interface GigabitEthernet0/2 description Backup L2 to A1 ip address 10.40.13.2 255.255.255.252 ip router isis CORE isis circuit-type level-2-only isis network point-to-point isis metric 40 level-2 ! interface Loopback0 ip address 172.20.3.1 255.255.255.255 ip router isis CORE
A2, B2, C2 — access routers
! A2 example; B2 and C2 substitute their area NET/IPs hostname A2 router isis CORE net 49.0001.0000.0000.0012.00 is-type level-1 metric-style wide ! interface GigabitEthernet0/0 description Uplink to A1 ip address 10.40.1.2 255.255.255.252 ip router isis CORE isis circuit-type level-1 isis network point-to-point ! interface Loopback0 ip address 172.20.11.1 255.255.255.255 ip router isis CORE
06 / IS-IS PDUs and TLVs
| PDU | Function | Field example |
|---|---|---|
| IIH (Hello) | Neighbor discovery / adjacency | Neighbor IDs, area addresses, capabilities |
| LSP | Topology and prefix advertisements | Reachability TLVs |
| CSNP | Complete LSDB summary | LSP IDs and sequence numbers |
| PSNP | Partial summary / acknowledgment or request | Missing LSP identifiers |
Examples of IPv4-related TLVs: 129 (protocols supported), 132 (IP interface address), 135 (extended IP reachability). RFC 5308 adds TLVs 232 and 236 for IPv6 addressing and reachability. LSP information is carried in extensible TLV structures rather than in a fixed IP routing-specific packet header.
07 / DIS elections and circuit types
On a multi-access LAN, IS-IS elects a Designated Intermediate System (DIS) to represent the segment via a pseudonode. Point-to-point Ethernet circuits do not elect a DIS.
interface GigabitEthernet0/3 description Broadcast LAN example ip router isis CORE isis priority 90 level-1 ! ! On a routed Ethernet point-to-point connection instead: interface GigabitEthernet0/1 isis network point-to-point
08 / SPF and wide metric walkthrough
For example, assume L2 cost from A1 to B1 is 10 and from B1 to C1 is 10, while the direct A1–C1 link has cost 40. SPF prefers the two-hop backbone path with cost 20. If B1–C1 fails, the direct link becomes a usable alternate with cost 40. This is an illustrative link-cost comparison, not live routing output.
router isis CORE metric-style wide ! interface GigabitEthernet0/1 isis metric 10 level-2 ! interface GigabitEthernet0/2 isis metric 40 level-2
Wide metrics improve cost range and support more modern extensions. Keep metric policy consistent across the routing domain, and check direction-specific interface costs on both ends.
09 / Troubleshooting command reference
| Command | Use |
|---|---|
show isis neighbors | Neighbor adjacency state |
show clns neighbors | CLNS-level neighbors on supported IOS versions |
show isis interface | Levels, timers, circuit type, priorities |
show clns interface | CLNS / IS-IS per-interface information |
show isis database | LSDB and LSPs |
show isis topology | SPF-derived topological view |
show ip route isis | Installed IPv4 IS-IS routes |
show isis spf-log | SPF recalculation history |
show running-config | section router isis | Process config / NET |
Command output syntax can differ between IOS XE, IOS XR and NX-OS; these examples target IOS XE-style syntax.
10 / Failure scenarios and triage
| Symptom | Likely check | Next action |
|---|---|---|
| No neighbor | Layer 2, interface shutdown, mismatched circuit types | Verify link state and hello reception |
| L1 neighbor fails | NET area IDs differ | Align L1 area addresses |
| L2 neighbor fails | Levels / authentication / MTU | Check matching L2 capability and authentication |
| Neighbor up, no route | Prefix TLVs, metric style, route filters, attached behavior | Check database then RIB |
| Frequent SPF events | Flapping links / unstable adjacency | Correlate logs and physical events |
| Routes not preferred | Administrative distance / metric / competing protocol | Inspect RIB and policy |
show logging | include ISIS|CLNS|LINEPROTO show isis neighbors detail show isis database detail show ip route 172.20.3.1 show interfaces GigabitEthernet0/1
11 / Authentication and security controls
Enable authenticated adjacencies where supported, restrict physical/L2 access to routing segments, validate allowed peers, protect the control plane, set passive or non-routing behavior where appropriate, log adjacency changes, and apply prefix control at redistribution points. Never use simple plaintext keys for production. Authentication configuration varies by release and device.
! Example of classic IOS XE interface-level MD5 key-chain key chain ISIS_KEYS key 1 key-string REPLACE_WITH_STRONG_SECRET ! interface GigabitEthernet0/1 isis authentication mode md5 level-2 isis authentication key-chain ISIS_KEYS level-2 !
Replace demonstration secrets, consult release support and your organization’s secret management controls, and roll keys simultaneously across neighbors. IS-IS adjacency authentication does not itself encrypt traffic.
12 / Quick lab checks and expected results
! On A1: show isis neighbors ! Expect L1 adjacency to A2, L2 to B1 and C1 show isis database ! Inspect separate Level-1 and Level-2 LSDBs show ip route isis ! Look for learned routes with IOS administrative distance 115 show isis spf-log ! Compare changes before and after controlled link failure
Practice: shut down the B1-to-C1 laboratory link (not production) and check whether SPF switches to A1–C1. Restore and verify all adjacencies. Record neighbor uptime, LSP sequence changes, and installed routes.
13 / Questions with explanations
Answer: Yes, for an L1 adjacency. L2 adjacency does not have that same area-matching requirement.
Q2: What is the DIS on point-to-point Ethernet?Answer: None; a DIS election is for broadcast multi-access networks.
Q3: Is IS-IS IP protocol 88?Answer: No. EIGRP uses IP protocol 88. IS-IS operates directly over Layer 2.
Q4: Why can a neighbor be up without an installed route?Answer: Adjacency confirms peering, not route selection. Inspect the LSDB, prefix advertisement, hierarchy, filter policy and RIB competition.
Q5: Why wide metrics?Answer: They support larger metric ranges and modern traffic engineering / protocol extensions.
Q6: Is an LSP identical to an IP packet?Answer: No. LSPs are IS-IS control-plane PDUs with TLVs describing topology and reachability.
14 / Source verification and editorial notes
This is an original MAG212 CYBER guide. The six-router Ethernet topology, IP plan, IOS XE lab, failure walkthrough, hardening guidance and practice questions were written independently and checked against the IETF standards and Cisco documentation below.
Primary technical references:
Cisco IS-IS Configuration Guide (IOS XE 17)
Cisco Network as Code — IOS XE IS-IS data model
RFC 1195 — integrated IS-IS
RFC 5308 — routing IPv6 with IS-IS
RFC 5305 — IS-IS TE extensions.
All IP addresses and device configurations are lab examples, not a representation of a production network. Validate platform compatibility and approved changes before deployment.
Published for educational use on cyber.mag212.com · Original topology and editorial text
More guides in Learn · EIGRP · BGP · Network consulting & seminars